be9f14ce34
A small helpdesk system: an office Pixel running a patched GrapheneOS Dialer answers technician calls, records both call legs as separate channels, and a Ruby backend transcribes them through Whisper and files an AI summary against the caller. Squashed to a single commit for sharing. No credentials are included; secrets live outside the repo in /etc/helpdesk/env on the server or a gitignored .claude/env.local locally. See .claude/env.local.example for the shape. Start at README.md, then docs/architecture.md.
40 lines
1.6 KiB
Text
40 lines
1.6 KiB
Text
# Reference copy of the device door installed at
|
|
# /opt/nginx/conf/sites-available/helpdesk-device.conf (symlinked into sites-enabled).
|
|
# TLS but NO client cert: the phone can't hold one. Authentication is the app-level HMAC
|
|
# (bearer + signature over ts.nonce.body + nonce replay + clock skew), verified by the backend.
|
|
# Strict path allowlist; operator-identity headers are blanked in the proxy snippet.
|
|
|
|
limit_req_zone $binary_remote_addr zone=helpdesk_device:10m rate=10r/s;
|
|
|
|
server {
|
|
listen 8443 ssl;
|
|
listen [::]:8443 ssl;
|
|
http2 on;
|
|
server_name moje.al.army;
|
|
|
|
ssl_certificate /etc/ssl/moje.al.army/fullchain.pem; # same Let's Encrypt cert as the console
|
|
ssl_certificate_key /etc/ssl/moje.al.army/privkey.pem;
|
|
ssl_protocols TLSv1.2 TLSv1.3;
|
|
ssl_prefer_server_ciphers off;
|
|
|
|
access_log /opt/nginx/logs/helpdesk-device.access.log main;
|
|
error_log /opt/nginx/logs/helpdesk-device.error.log;
|
|
|
|
# Allowlist: exactly the paths the phone uses. Everything else 404s at the edge.
|
|
location /api/v1/calls/ {
|
|
limit_req zone=helpdesk_device burst=30 nodelay;
|
|
client_max_body_size 64k;
|
|
include snippets/helpdesk-device-proxy.conf;
|
|
}
|
|
location /api/v1/device/ {
|
|
limit_req zone=helpdesk_device burst=30 nodelay;
|
|
client_max_body_size 64k;
|
|
include snippets/helpdesk-device-proxy.conf;
|
|
}
|
|
location /api/v1/recordings/ {
|
|
limit_req zone=helpdesk_device burst=10 nodelay;
|
|
client_max_body_size 64m; # a 33 min lossless WAV or ~89 min of AAC; see docs/device-api.md
|
|
include snippets/helpdesk-device-proxy.conf;
|
|
}
|
|
location / { return 404; }
|
|
}
|